MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab41095b56e2290469fe7f7edbc26c55a0c525c2e7f7f94ea8f7d4c111a3196a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ab41095b56e2290469fe7f7edbc26c55a0c525c2e7f7f94ea8f7d4c111a3196a
SHA3-384 hash: 5406f08f7d60cad64bcb1ed41ebe4b78c9de42ad5ccabb8f6e74816c55a5106cfe7eb0cae8a36d3a9a143b8ea2dd3e28
SHA1 hash: 1d0ad4ca2204b0c77544a6dee7a3a7ee23de9901
MD5 hash: 0cf3d3178a4f4616797f05235284e8be
humanhash: carolina-queen-charlie-minnesota
File name:Payment01.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-18 08:49:02 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:NRU8oax73DvQapA6N0zCPFgFXxy4dd8kFfjkaOQaddD3fNShfxsnRmjh6:Ne8oaxppVgFXxlbUnpPoMnf
TLSH D8450123338463A7E875933A1024614017F6FD56A7A1CA5D7D8E324D0F72F92C7A2BA3
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.gozenholdings.com
Sending IP: 104.168.134.103
From: "Gozen Holdings " <info@gozenholdings.com>
Subject: Payment Deposit
Attachment: Payment01.img (contains "Payment01.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ab41095b56e2290469fe7f7edbc26c55a0c525c2e7f7f94ea8f7d4c111a3196a/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 11:30:36 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vnaqsw2w4iuqi2p6p57nxqtmkwqmkjoc4737stvi67kmcenddfva._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img ab41095b56e2290469fe7f7edbc26c55a0c525c2e7f7f94ea8f7d4c111a3196a

(this sample)

AgentTesla

Executable exe 7ce411ff4c9298f999527e39ad53f76697804e3ca427499db5da0292f8ef710b

  
Dropping
MD5 27d4f4a689c97c79a8be84956d9ad074
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7ce411ff4c9298f999527e39ad53f76697804e3ca427499db5da0292f8ef710b

Comments